MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-03-30 17:23:42 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: regression in loading LDAP users policy mappings (#18055)

Browse Source 
LDAP users are stored as STS users, we need to load
their policy mappings appropriately.

Fixes a regression caused by #17994
This commit is contained in:
Harshavardhana 2023-09-19 10:31:56 -07:00 committed by GitHub
parent 2add57cfed
commit fcfadb0e51
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 23 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
cmd/iam-store.go
View File

@ -364,9 +364,9 @@ func (c *iamCache) removeGroupFromMembershipsMap(group string) {
// information in IAM (i.e sys.iam*Map) - this info is stored only in the STS // information in IAM (i.e sys.iam*Map) - this info is stored only in the STS
// generated credentials. Thus we skip looking up group memberships, user map, // generated credentials. Thus we skip looking up group memberships, user map,
// and group map and check the appropriate policy maps directly. // and group map and check the appropriate policy maps directly.
func (c *iamCache) policyDBGet(mode UsersSysType, name string, isGroup bool) ([]string, time.Time, error) { func (c *iamCache) policyDBGet(store *IAMStoreSys, name string, isGroup bool) ([]string, time.Time, error) {
if isGroup { if isGroup {
if mode == MinIOUsersSysType { if store.getUsersSysType() == MinIOUsersSysType {
g, ok := c.iamGroupsMap[name] g, ok := c.iamGroupsMap[name]
if !ok { if !ok {
return nil, time.Time{}, errNoSuchGroup return nil, time.Time{}, errNoSuchGroup
@ -398,7 +398,12 @@ func (c *iamCache) policyDBGet(mode UsersSysType, name string, isGroup bool) ([]
if !ok { if !ok {
// Since user "name" could be a parent user of an STS account, we lookup // Since user "name" could be a parent user of an STS account, we lookup
// mappings for those too. // mappings for those too.
mp = c.iamSTSPolicyMap[name] mp, ok = c.iamSTSPolicyMap[name]
if !ok {
// Attempt to load parent user mapping for STS accounts
store.loadMappedPolicy(context.TODO(), name, stsUser, false, c.iamSTSPolicyMap)
mp = c.iamSTSPolicyMap[name]
}
} }
// returned policy could be empty // returned policy could be empty
@ -544,18 +549,6 @@ func (store *IAMStoreSys) LoadIAMCache(ctx context.Context) error {
return err return err
} }
bootstrapTraceMsg("loading STS users")
// load STS temp users
if err := store.loadUsers(ctx, stsUser, newCache.iamSTSAccountsMap); err != nil {
return err
}
bootstrapTraceMsg("loading STS policy mapping")
// load STS policy mappings
if err := store.loadMappedPolicies(ctx, stsUser, false, newCache.iamSTSPolicyMap); err != nil {
return err
}
newCache.buildUserGroupMemberships() newCache.buildUserGroupMemberships()
} }
@ -671,14 +664,14 @@ func (store *IAMStoreSys) PolicyDBGet(name string, isGroup bool, groups ...strin
cache := store.rlock() cache := store.rlock()
defer store.runlock() defer store.runlock()
policies, _, err := cache.policyDBGet(store.getUsersSysType(), name, isGroup) policies, _, err := cache.policyDBGet(store, name, isGroup)
if err != nil { if err != nil {
return nil, err return nil, err
} }
if !isGroup { if !isGroup {
for _, group := range groups { for _, group := range groups {
ps, _, err := cache.policyDBGet(store.getUsersSysType(), group, true) ps, _, err := cache.policyDBGet(store, group, true)
if err != nil { if err != nil {
return nil, err return nil, err
} }
@ -864,7 +857,7 @@ func (store *IAMStoreSys) GetGroupDescription(group string) (gd madmin.GroupDesc
cache := store.rlock() cache := store.rlock()
defer store.runlock() defer store.runlock()
ps, updatedAt, err := cache.policyDBGet(store.getUsersSysType(), group, true) ps, updatedAt, err := cache.policyDBGet(store, group, true)
if err != nil { if err != nil {
return gd, err return gd, err
} }
@ -965,7 +958,13 @@ func (store *IAMStoreSys) PolicyDBUpdate(ctx context.Context, name string, isGro
var mp MappedPolicy var mp MappedPolicy
if !isGroup { if !isGroup {
if userType == stsUser { if userType == stsUser {
mp = cache.iamSTSPolicyMap[name] var ok bool
mp, ok = cache.iamSTSPolicyMap[name]
if !ok {
// Attempt to load parent user mapping for STS accounts
store.loadMappedPolicy(context.TODO(), name, stsUser, false, cache.iamSTSPolicyMap)
mp = cache.iamSTSPolicyMap[name]
}
} else { } else {
mp = cache.iamUserPolicyMap[name] mp = cache.iamUserPolicyMap[name]
} }
@ -1620,7 +1619,11 @@ func (store *IAMStoreSys) UserNotificationHandler(ctx context.Context, accessKey
} }
if userType != svcUser { if userType != svcUser {
err = store.loadMappedPolicy(ctx, accessKey, userType, false, cache.iamUserPolicyMap) if userType == stsUser {
err = store.loadMappedPolicy(ctx, accessKey, userType, false, cache.iamSTSPolicyMap)
} else {
err = store.loadMappedPolicy(ctx, accessKey, userType, false, cache.iamUserPolicyMap)
}
// Ignore policy not mapped error // Ignore policy not mapped error
if err != nil && !errors.Is(err, errNoSuchPolicy) { if err != nil && !errors.Is(err, errNoSuchPolicy) {
return err return err